All Apps and Add-ons

Splunk Query

mailmetoramu
Explorer

Hello All,

In one of my server the access has been given to Adam, Brian and Charlie on the host "xyxxac.bus.com".

I need to know who have added these members into that server, Please let me know the exact Splunk query.

Also i have installed Splunk UF software on this server last week only, is it possible to pull the logs from this server for last month ??

Thanks,

Ramu.R

Tags (1)
0 Karma

DavidHourani
Super Champion

Hey @mailmetoramu,

You can check who added the users by collecting windows logs of the servers. If you have AD running then you'll have to collect logs from there to get that information.

More info on collecting windows logs here :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/MonitorWindowseventlogdata

More info on collecting AD logs here :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/MonitorActiveDirectory

Cheers,
David

0 Karma

DavidHourani
Super Champion

windows server ? Linux Server ? Splunk Server ? Could you please give some details ?

0 Karma

mailmetoramu
Explorer

Windows Server actually ..!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...